perf(storage): 拦截任务二进制并本地暂存结果

原因：任务标准结果中的 Base64、Data URI 和 Buffer 会进入 PostgreSQL JSON，导致 TOAST 与备份体积快速增长。

影响：新增统一 JSON 持久化关口；upload_none 将二进制原子写入本地结果目录，数据库仅保存带 SHA-256 的有界占位符；任务详情、同步响应、异步查询和兼容协议按需校验恢复。补充 24 小时清理、容量上限、历史小批量治理命令及管理端说明。

风险：本地结果超过 TTL、丢失或损坏时分别返回明确的 410/500；空间不足时返回 503 且不重试上游。未自动执行历史治理。

验证：三种真实图片模型同步/异步与幂等重放通过；Go vet/全量测试、前端 111 测试、lint/typecheck/build、OpenAPI、迁移安全、govulncheck、依赖审计、手工发布测试及 Linux amd64 构建通过。

apps/api/internal/httpapi/handlers.go

@@ -1134,6 +1134,10 @@ func (s *Server) createTask(kind string, compatible bool) http.Handler {
 				writeTaskError(http.StatusConflict, "Idempotency-Key was reused for a different request", nil, "idempotency_key_reused")
 				return
 			}
+			if errors.Is(err, store.ErrTaskRequestBinaryNotMaterialized) {
+				writeTaskError(http.StatusBadRequest, err.Error(), nil, clients.ErrorCode(err))
+				return
+			}
 			s.logger.Error("create task failed", "kind", kind, "error_category", "task_create_failed")
 			writeTaskError(http.StatusInternalServerError, "create task failed", nil, "task_create_failed")
 			return
@@ -1150,6 +1154,17 @@ func (s *Server) createTask(kind string, compatible bool) http.Handler {
 				writeTaskError(http.StatusConflict, "streaming idempotent replay is not supported", nil, "idempotency_stream_replay_unsupported")
 				return
 			}
+			if task.Status == "succeeded" && !responsePlan.asyncMode && (targetProtocol != "" || responsePlan.compatibleMode) {
+				task, err = s.hydrateTaskResult(r.Context(), task)
+				if err != nil {
+					if targetProtocol != "" {
+						writeProtocolError(w, targetProtocol, statusFromRunError(err), err.Error(), nil, clients.ErrorCode(err))
+					} else {
+						writeStoredBinaryResultError(w, err)
+					}
+					return
+				}
+			}
 			if targetProtocol != "" && !responsePlan.asyncMode {
 				if task.Status == "succeeded" {
 					writeJSON(w, http.StatusOK, task.Result)
@@ -1597,6 +1612,12 @@ func scopeForTaskKind(kind string) string {
 
 func statusFromRunError(err error) int {
 	switch {
+	case clients.ErrorCode(err) == "binary_result_expired":
+		return http.StatusGone
+	case clients.ErrorCode(err) == "binary_result_corrupted" || clients.ErrorCode(err) == "result_binary_not_materialized":
+		return http.StatusInternalServerError
+	case clients.ErrorCode(err) == "local_result_storage_unavailable":
+		return http.StatusServiceUnavailable
 	case clients.ErrorCode(err) == "billing_hold":
 		return http.StatusServiceUnavailable
 	case runner.IsPricingUnavailable(err):
@@ -1901,6 +1922,7 @@ func boolValue(body map[string]any, key string) bool {
 // @Success 200 {object} store.GatewayTask
 // @Failure 401 {object} ErrorEnvelope
 // @Failure 404 {object} ErrorEnvelope
+// @Failure 410 {object} ErrorEnvelope
 // @Failure 500 {object} ErrorEnvelope
 // @Router /api/workspace/tasks/{taskID} [get]
 // @Router /api/v1/tasks/{taskID} [get]
@@ -1920,6 +1942,11 @@ func (s *Server) getTask(w http.ResponseWriter, r *http.Request) {
 		task.Cancellable = &cancelState.Cancellable
 		task.Submitted = &cancelState.Submitted
 		task.Message = cancelState.Message
+		task, err = s.hydrateTaskResult(r.Context(), task)
+		if err != nil {
+			writeStoredBinaryResultError(w, err)
+			return
+		}
 		writeJSON(w, http.StatusOK, task)
 		return
 	}